Malicious Package

Overview cross-sessions is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-64168 Agno session state overwrites between different sessions/users

Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when sessionstate is passed to Agent or Team during run or arun calls, a race condition can occur, causing a sessionstate to be assigned and persisted to the incorrect session. This may...

MAL-2025-48830 Malicious code in cross-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707ceb348b4322557a9b20a0391fd548abc37c4decad76c7395e862525e7fba8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cross-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707ceb348b4322557a9b20a0391fd548abc37c4decad76c7395e862525e7fba8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use of Cache Containing Sensitive Information

Overview querycommander is a Browser-based SQL Query Tool for Universal Database Management Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information potentially exposing user data across sessions due to improper caching. Remediation Upgrade querycommander ...

PT-2023-24654 · Spring · Spring For Graphql

Name of the Vulnerable Software and Affected Versions: Spring for GraphQL versions 1.1.0 through 1.1.5 Spring for GraphQL versions 1.2.0 through 1.2.2 Description: A batch loader function in Spring for GraphQL may be exposed to GraphQL context with values, including security context values, from ...

SUSE CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...